Internet-facing device identification

ABSTRACT

Technology described herein determines whether a device is Internet facing. An Internet facing device is a device where traffic coming from the Internet is routable to the device. The technology described herein may comprise two components that work together to identify Internet-facing devices. The first component is a monitoring agent installed on organizational devices. The second component is an Internet-facing management service, which may be cloud based. The monitoring agent communicates connection-event notices to the Internet-facing management service. The source IP address in the connection-event notice is compared to a list of organizational IP addresses. If the source IP address is not on the list, then the computing device associated with the notice is added to a list of Internet-facing devices because the connection originated from the Internet. Software listed in the connection-event notice may be added to a list of internet-facing software instances.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a divisional of U.S. patent application Ser. No.17/141,184, filed Jan. 4, 2021, and entitled, “INTERNET-FACING DEVICEIDENTIFICATION,” the entirety of which application is herebyincorporated by reference.

BACKGROUND

The Internet facilitates communication between computers all over theworld. Unfortunately, this connectivity provides a means for bad actorsto attempt unauthorized access to an organization's computer network.Organizations employ security measures to prevent unauthorized access.Organizations may pay special attention to Internet facing deviceswithin the organization, since attacks from the Internet will comethrough these devices. However, tracking an organization's Internetfacing devices is not a trivial task. Existing technology foridentifying Internet facing devices within an organization areinefficient and unreliable. The existing techniques include scanninginternal network traffic and external scanning. These are both resourceintensive methods that may also fail to adequately identify an Internetfacing device in some circumstances.

SUMMARY

This summary is provided to introduce a selection of concepts in asimplified form that are further described below in the detaileddescription. This summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used in isolation as an aid in determining the scope of the claimedsubject matter.

The technology described herein more accurately identifiesInternet-facing devices within an organization (e.g., a corporation,charitable organization, school, government entity). Organizations haveboth Internet-facing devices and non-Internet facing devices. AnInternet facing device is a device where traffic coming from theInternet is routable to the device. These two classes of devices may betreated differently for security purposes or other reasons and it isdesirable to maintain an accurate list of Internet-facing devices withinan organization.

At a very high level, the technology described herein may comprise twocomponents that work together to identify Internet-facing devices. Thefirst component is a monitoring agent installed on organization'sdevices. The second component is an Internet-facing management service,which may be cloud based. The monitoring agent provides identificationinformation for a device on which it is running along withconnection-event notices. Because the monitoring agent is installed onthe computing device, it is able to provide more accurate identificationinformation for the device than existing solutions that identifyInternet-facing devices, such as network scanning and externalexploration technologies. The existing technologies are limited toidentifying a device based on information contained in a data packet,such as an IP address, which is a less reliable way to identify a devicebecause some device's IP address will change or be shared.

The monitoring agent may be installed on any computing device capable ofexecuting code. In some aspects, the monitoring agent may run on asubset of the organization's devices, such as servers and user devices.The monitoring agent looks at network connections on the device andgenerates a connection-event notice when the connection meets acriteria. The criteria can include whether the source IP address for aconnection is a public IP address. A connection with a private source IPaddress may not provide useful information because it is likelyoriginating within an organization's network, rather than the Internet.Connections originating on the Internet should have a public source IPaddress. Thus, aspects of the technology described herein may generateevents only when the source IP address is a public IP address. The goalof the second criteria is to identify connections that originate at adevice other than the computing device on which the monitoring agent isrunning The second criteria compares the source IP address for aconnection to IP addresses associated with the device on which themonitoring agent is installed. If the source IP address is not assignedto the device on which the monitoring agent is installed, then aconnection-event notice is generated.

The connection-event notice is communicated to the Internet-facingdevice management service. The connection-event notice may include thesource IP address, target IP address, device port on which theconnection operates, process on machine that is being exposed to theInternet (e.g., opened the connection), the entire command line that islistening to the connection, and the like.

The Internet-facing device management service receives bothconnection-event notices and agent-status reports. As mentioned, theagent-status reports identify IP addresses associated with the device onwhich the agent is running The IP addresses may be extracted from theagent-status reports and entered into an organizational IP addressstore. The organization IP address store records IP addresses associatedwith the organization as indicated on the agent-status reports. Inaspects, the organization IP address store can also be supplemented withadditional IP addresses known to be associated with the organization.

The Internet-facing device management service compares the source IPaddress identified in a connection-event notice with organizational IPaddresses recorded in the organizational IP address store. If the sourceIP address is not an organizational IP address, then the deviceassociated with the connection-event notice is added to a record ofInternet-facing devices. In an aspect, software instances that use theconnection are added to a list of Internet-facing software instances.The software instance can be identified in the connection-event notice.As mentioned, the connection-event notice can list any softwareinstances that opened the connection or are otherwise communicating overthe connection.

The list of Internet-facing software instances and Internet-facingdevices can be used to improve security within an organization. Forexample, when a patch is received for a software having Internet-facingsoftware instances, the patch may be rolled out to these instancesfirst. Similar prioritization could be given to Internet-facing deviceswhen performing maintenance, updates, security checks, or othermanagement tasks.

BRIEF DESCRIPTION OF THE DRAWINGS

Aspects of the invention are described in detail below with reference tothe attached drawing figures, wherein:

FIG. 1 is a block diagram of an example operating environment suitablefor implementing aspects of the technology;

FIG. 2 is a diagram showing an Internet facing device managementservice, according to an aspect of the technology described herein;

FIGS. 3-5 are an exemplary process flow diagram showing a method ofidentifying Internet facing computing devices in an organization,according to an aspect of the technology described herein; and

FIG. 6 is a block diagram of an exemplary computing environment suitablefor use in implementing an aspect of the technology.

DETAILED DESCRIPTION

The subject matter of aspects of the technology is described withspecificity herein to meet statutory requirements. However, thedescription itself is not intended to limit the scope of this patent.Rather, the inventors have contemplated that the claimed subject mattermight also be embodied in other ways, to include different steps orcombinations of steps similar to the ones described in this document, inconjunction with other present or future technologies. Moreover,although the terms “step” and/or “block” may be used herein to connotedifferent elements of methods employed, the terms should not beinterpreted as implying any particular order among or between varioussteps herein disclosed unless and except when the order of individualsteps is explicitly described.

The technology described herein more accurately identifiesInternet-facing devices within an organization (e.g., a corporation,charitable organization, school, government entity). Organizations haveboth Internet-facing devices and non-Internet facing devices. AnInternet facing device is a device where traffic coming from theInternet is routable to the device. These two classes of devices may betreated differently for security purposes or other reasons and it isdesirable to maintain an accurate list of Internet-facing devices withinan organization.

At a very high level, the technology described herein comprises twocomponents that work together to identify Internet-facing devices. Thefirst component is a monitoring agent installed on the organization'sdevices. The second component is an Internet-facing management service,which may be cloud based. The monitoring agent provides identificationinformation for a device on which it is running along withconnection-event notices. Because the monitoring agent is installed onthe computing device, it is able to provide more accurate identificationinformation for the device than existing solutions that findInternet-facing devices, such as network scanning and externalexploration technologies.

The technology described herein significantly reduces the amount ofnetwork resources (e.g., bandwidth) used to identify Internet facingdevices within an organization when compared to existing methods ofidentifying Internet facing devices. For example, one current method ofidentifying Internet facing devices periodically scans network trafficwithin an organization's network and mirrors the traffic to an analysistool. The analysis tool analyzes all of the networked traffic andidentifies Internet facing devices. Mirroring a large amount of networktraffic is resource intensive and can significantly impact networkperformance while the mirroring is ongoing. In contrast, the presenttechnology uses a monitoring agent on each device to generateconnection-events that indicate the device on which it is installed ispossibly Internet facing. Most devices in an organization are notInternet facing, so only a few connection-event notices should begenerated. With the technology described herein, the monitoring occurson the devices receiving traffic, which eliminates the need to mirrorthe traffic to a separate device for analysis. The bandwidth used by thetechnology described herein for connection-event notices is minimalcompared to a mirroring operation. In aspects, the technology describedherein does not mirror an organization's network traffic.

The technology described herein also saves resources when compared to asecond currently available technology for identifying Internet facingdevices in an organization, which attempts to connect to each devicefrom outside the organization network. If a connection is formed, thenthe connected-to device is designated Internet facing, otherwise it isdesignated as not Internet facing. This technique requires a messageattempting to initiate a communication session be sent to each device,most of which will not be Internet facing. In contrast, the technologydescribed herein sends connection-event notices from machines that areInternet facing based on communications received in the course of normaluse. Thus, the technology described herein does not need to generate any“test” communications or other artificial attempts to set up acommunication session. The technology described herein uses only“normal” traffic and does not generate extra traffic through attempts toconnect to devices from outside the network for the specific purpose ofidentifying Internet facing devices.

The monitoring agent of the technology described herein is also able togenerate more detailed information about an organization's Internetfacing devices. Typically, only IP addresses and DNS addresses can beextracted through the traffic analysis used in the presently availabletechnologies. In contrast to existing technology, the technologydescribed herein can generate unique identification for devices. Forexample, a device may be identified with its Globally Unique Identifier(“GUID”) or Universally Unique Identifier (“UUID”) depending on theoperating environment. Other identification information that may be usedincludes a media access control (“MAC”) address and fully qualifieddomain name While these are known ways to identify a device, existingtechnology for identifying Internet-facing devices does not have accessto this information because the technologies do not have direct accessto the organization's devices. The existing technologies are limited toidentifying a device based on information contained in a data packet,such as an IP address, which is a less reliable way to identify a devicebecause some device's IP address will change or be shared.

The monitoring agent may be installed on any computing device capable ofexecuting code. In some aspects, the monitoring agent may run on asubset of organization's devices, such as servers and user devices. Themonitoring agent looks at network connections on the device andgenerates a connection-event notice when the connection meets acriteria. The criteria can include whether the source IP address for aconnection is a public IP address. If it is private and not public, thena connection-event notice may not be generated. As mentioned, a goal ofthe technology is to identify Internet-facing devices. A connection witha private source IP address may not provide useful information becauseit is likely originating within an organization's network, rather thanthe Internet. Connections originating on the Internet should have apublic source IP address. Thus, aspects of the technology describedherein may generate events only when the source IP address is a publicIP address. Generating connection-event notices only when the source IPaddress is public can provide improved efficiency over methods thatmirror all connections or generate reports for all connections.

The goal of the second criteria is to identify connections thatoriginate at a device other than the computing device on which themonitoring agent is running The second criteria compares the source IPaddress to IP addresses associated with the device on which themonitoring agent is installed. If the source IP address is not assignedto the device on which the monitoring agent is installed, then aconnection-event notice is generated.

The connection-event notice is communicated to the Internet-facingdevice management service. The connection-event notice may include thesource IP address, target IP address, device port on which theconnection operates, software or process on machine that is beingexposed to the Internet (e.g., opened the connection), the entirecommand line that is listening to the connection, and the like. In oneaspect, the connection is a Transmission Control Protocol and theInternet Protocol (“TCP/IP”) or a User Datagram Protocol (“UDP”)connection.

The Internet-facing device management service receives bothconnection-event notices and agent-status reports. As mentioned, theagent-status reports identify IP addresses associated with the device onwhich the agent is running The IP addresses may be extracted from theagent-status reports and entered into an organizational IP addressstore. The organizational IP address store records IP addressesassociated with the organization as indicated on the agent-statusreports. In aspects, the organizational IP address store can also besupplemented with additional IP addresses known to be associated withthe organization.

The Internet-facing device management service compares the source IPaddress identified in a connection-event notice with organizational IPaddresses recorded in the organizational IP address store. If the sourceIP address is not an organizational IP address, then the deviceassociated with the connection-event notice is added to a record ofInternet-facing devices. In an aspect, software instances that use theconnection are added to a list of Internet-facing software instances.The software instance can be identified in the connection-event notice.As mentioned, the connection-event notice can list any softwareinstances that opened the connection or are otherwise communicating overthe connection.

The list of Internet-facing software instances and Internet-facingdevices can be used to improve security within an organization. Forexample, when a patch is received for a software having Internet-facingsoftware instances, the patch may be rolled out to these instancesfirst. Similar prioritization could be given to Internet-facing deviceswhen performing maintenance, updates, security checks, or othermanagement tasks.

As used herein, a public IP address is addressable on the Internet. Inone aspect, a public IP address is any address outside of a rangedesignated as private.

As used herein, a private IP address is not addressable on the Internet,but may be used within a local network. Devices associated with privateIP address may still access the Internet. In one aspect, a private IPaddress is any address inside a range designated by a governing body asprivate. According to standards set forth in Internet Engineering TaskForce (IETF) document RFC-1918, the following IPv4 address ranges arereserved for private internets, and are not publicly routable on theglobal internet: 10.0.0.0-10.255.255.255; 172.16.0.0-172.31.255.255; and192.168.0.0-192.168.255.255.

Turning now to FIG. 1 , a block diagram is provided showing an operatingenvironment 100 in which aspects of the present disclosure may beemployed. It should be understood that this and other arrangementsdescribed herein are set forth only as examples. Other arrangements andelements (e.g., machines, interfaces, functions, orders, and groupingsof functions) can be used in addition to or instead of those shown, andsome elements may be omitted altogether for the sake of clarity.Further, many of the elements described herein are functional entitiesthat may be implemented as discrete or distributed components or inconjunction with other components, and in any suitable combination andlocation. Various functions described herein as being performed by oneor more entities may be carried out by hardware, firmware, and/orsoftware. For instance, some functions may be carried out by a processorexecuting instructions stored in memory.

Among other components not shown, example operating environment 100includes a number of user devices, such as user devices 102 a, 102 b,and 102 c through 102 n; a number of servers, such as servers 104 a, 104b, and 104 c through 104 n; Internet facing device management server106; network 110; and organizational network 112. It should beunderstood that environment 100 shown in FIG. 1 is an example of onesuitable operating environment. Each of the components shown in FIG. 1may be implemented via any type of computing device, such as computingdevice 600, described in connection to FIG. 6 , for example. Thesecomponents may communicate with each other via network 110, which mayinclude, without limitation, one or more local area networks (LANs)and/or wide area networks (WANs). In exemplary implementations, network110 comprises the Internet and/or a cellular network, amongst any of avariety of possible public and/or private networks. Organizationalnetwork 112 may include, without limitation, one or more local areanetworks (LANs) and/or wide area networks (WANs). Organization network112 connects organization computing devices (e.g., user device 102 c andserver 106 c) with each other and may facilitate connections to otherdevices associated with the organization or outside of the organization,for example, through network 110. The Organization network 112 may becontrolled directly or indirectly by an organization for its own use.The organization network 112 may allow devices on the network 112 todiscover and communicate with each other, while excluding devices fromoutside the organization network 112 from the same discovery andcommunication. Access to the organization network 112 may be guardedwith various security mechanisms, such as a firewall.

It should be understood that any number of user devices and servers maybe employed within operating environment 100 within the scope of thepresent disclosure. Each may comprise a single device or multipledevices cooperating in a distributed environment. For instance, Internetfacing device management server 106 may be provided via multiple devicesarranged in a distributed environment that collectively provide thefunctionality described herein. Additionally, other components not shownmay also be included within the distributed environment.

User devices 102 a, 102 b, and 102 c through 102 n can be client deviceson the client-side of operating environment 100, while Internet facingdevice management server 106, and servers 104 a, 104 b, and 104 cthrough 104 n can be on the server-side of operating environment 100.Server 106 can comprise server-side software designed to work inconjunction with client-side software (e.g., monitoring agent) on userdevices 102 a, 102 b, and 102 c through 102 n and servers 104 a, 104 b,and 104 c through 104 n so as to implement any combination of thefeatures and functionalities discussed in the present disclosure. Someof servers 104 a, 104 b, and 104 c through 104 n may be theorganization's devices and some may be non-organization devices.Similarly, some of user devices 102 a, 102 b, and 102 c through 102 nmay be the organization's devices and some may be non-organizationdevices. FIG. 1 shows that user device 102 a and 102 c are organization,while servers 104 a and 104 c are organization servers. Notice thatorganization devices can be connected directly to network 110 (which caninclude the Internet), for example, by an employee (e.g., using userdevice 102 a) working from home or to organization network 112 (e.g.,user device 102 c).

A goal of the technology described herein is to identify Internet facingdevices, both user devices and servers, within the organization. This isachieved, in part, by detecting when a device from outside theorganization initiates a connection to an organization's device. Thoughnot shown, the devices from environment 100 associated with theorganization may have a monitoring agent installed. This division ofoperating environment 100 is provided to illustrate one example of asuitable environment, and there is no requirement for eachimplementation that any combination of search server 106, servers 104 a,104 b, and 104 c through 104 n, and user devices 102 a, 102 b, and 102 cthrough 102 n remain as separate entities. The monitoring agent on theorganization's servers and user devices can communicate status reportsand connection-event notices to the Internet facing device managementserver 106.

User devices 102 a, 102 b, and 102 c through 102 n may comprise any typeof computing device capable of use by a user. For example, in oneaspect, user devices 102 a through 102 n may be the type of computingdevice described in relation to FIG. 6 herein. By way of example and notlimitation, a user device may be embodied as a personal computer (PC), alaptop computer, a mobile or mobile device, a smartphone, a tabletcomputer, a smart watch, a wearable computer, a personal digitalassistant (PDA), an MP3 player, global positioning system (GPS) ordevice, video player, handheld communications device, gaming device orsystem, entertainment system, vehicle computer system, embedded systemcontroller, remote control, appliance, consumer electronic device, aworkstation, or any combination of these delineated devices, or anyother suitable device where notifications can be presented. A user maybe associated with one or more user devices. The user may communicatewith server 106, servers 104 a, 104 b, and 104 c through 104 n, throughthe user devices.

Each of these devices may be associated with an IP address that iseither private or public. The Internet facing devices (e.g., user device102 b and server 104 b) will typically be associated with public IPaddresses, while all others will be assigned private IP addresses. Asdescribed previously, the following IPv4 address ranges are reserved forprivate internets, and are not publicly routable on the global internet:10.0.0.0-10.255.255.255; 172.16.0.0-172.31.255.255; and192.168.0.0-192.168.255.255.

Operating environment 100 can be utilized to implement one or more ofthe components of system 200, described in FIG. 2 , including componentsfor managing Internet facing computing devices.

Referring now to FIG. 2 , with FIG. 1 , a block diagram is providedshowing aspects of an example computing system architecture suitable forimplementing an aspect of the technology and designated generally assystem 200. System 200 represents only one example of a suitablecomputing system architecture. Other arrangements and elements can beused in addition to or instead of those shown, and some elements may beomitted altogether for the sake of clarity. Further, as with operatingenvironment 100, many of the elements described herein are functionalentities that may be implemented as discrete or distributed componentsor in conjunction with other components, and in any suitable combinationand location.

At a high level, system 200 comprises Internet-facing device managementservice 201 that identifies organizational devices that are Internetfacing. For the sake of illustration, the user device 102 a is anorganizational device and the server 104 a is a non-organizationaldevice. The server 104 a is associated with IP address 236. TheInternet-facing device management service 201 may be embodied on one ormore servers, such as Internet-facing device management server 106. Thisis a simplified environment. In a real word scenario, an organizationcould have many devices. Only a single outside the organization deviceis shown for the sake of simplicity, but in a real world scenario, manycould be present.

Example system 200 includes the Internet-facing device managementservice 201. The Internet-facing device management service 201 (and itscomponents) may be embodied as a set of compiled computer instructionsor functions, program modules, computer software services, or anarrangement of processes carried out on one or more computer systems,such as computing device 600 described in connection to FIG. 6 , forexample.

In one aspect, the functions performed by components of system 200 areassociated with one or more applications, services, or routines. Inparticular, such applications, services, or routines may operate on oneor more user devices (such as user device 102 a), servers (such asInternet-facing device management server 106), may be distributed acrossone or more user devices and servers, or be implemented in the cloud.Moreover, in some aspects, these components of system 200 may bedistributed across a network, including one or more servers (such asserver 106) and client devices (such as user device 102 a), in thecloud, or may reside on a user device such as user device 102 a.Moreover, these components, functions performed by these components, orservices carried out by these components may be implemented atappropriate abstraction layer(s) such as the operating system layer,application layer, hardware layer, etc., of the computing system(s).Alternatively, or in addition, the functionality of these componentsand/or the aspects of the technology described herein can be performed,at least in part, by one or more hardware logic components. For example,and without limitation, illustrative types of hardware logic componentsthat can be used include Field-programmable Gate Arrays (FPGAs),Application-specific Integrated Circuits (ASICs), Application-specificStandard Products (ASSPs), System-on-a-chip systems (SOCs), ComplexProgrammable Logic Devices (CPLDs), etc. Additionally, althoughfunctionality is described herein with regards to specific componentsshown in example system 200, it is contemplated that in some aspects,functionality of these components can be shared or distributed acrossother components.

The user device 102 a comprises monitoring agent 230, which comprises anagent-status component 232 and a connection-event notice component 234.User device 102 a is associated with IP address 235 and may also beassociated with other identification information, such as a GUID (notshown).

The monitoring agent 230 runs on user device 102 a. Similar monitoringagents may run on other computing devices associated with theorganization. The monitoring agent 230 may perform other functions inaddition to those described herein. Monitoring agent 230 providesupdated identification information for the computing device to theInternet-facing device management service 201. The monitoring agent 230also provides connection-event notices upon detecting irrelevantconnection to the computing device.

The agent-status component 232 provides identification information andIP address 235 information for the computing device to theInternet-facing device management service 201. This information may beprovided in agent-status reports. An agent-status report may be providedupon first installing the monitoring agent on the computing device.Additional notices may be provided periodically (e.g., monthly, weekly)or triggered in response to detecting a change. For example, a detectedaddition or subtraction to the IP addresses associated with thecomputing device may trigger an agent-status report that includes theupdated list of IP addresses. As explained herein, the Internet-facingdevice management service 201 processes agent-status reports to generatea current list of IP addresses associated with an organization. Theagent-status reports may also be used to generate a current list ofcomputing devices within the organization that are associated withmonitoring agents.

The connection-event notice component 234 generates a connection-eventnotice upon detecting a connection that satisfies event generationcriteria. In one aspect, the connection is a Transmission ControlProtocol and the Internet Protocol (“TCP/IP”) or a User DatagramProtocol (“UDP”) connection, but other connection types may also bemonitored. The event generation criteria can include determining thatthe source IP address associated with a connection is a public IPaddress. For example, a communication originating with server 104 a willbe associated with IP address 236. As mentioned, a goal of thetechnology is to identify Internet-facing devices. A connection with aprivate source IP address may not provide useful information because itis likely originating within an organization's network, rather than theInternet. Connections originating on the Internet should have a publicsource IP address. Thus, aspects of the technology described herein maygenerate events only when the source IP address is a public IP address.Generating connection-event notices only when the source IP address ispublic can provide improved efficiency over methods that mirror allconnections or generate reports for all connections.

The second event generation criteria identifies incoming connections.Incoming connections originate at a different computing device and havea source IP address associated with the different computing device.Thus, the second event generation criteria may be that the source IPaddress is not associated with the computing device on which themonitoring agent is running, in this example user device 102 a. If thesource IP address was associated with the computing device on which themonitoring agent is running then the connection would have originated atthe computing device. Such a connection is outgoing and does not helpdetermine whether the computing device is addressable from the Internet,and thus Internet facing. In an aspect, connection-event notices are notgenerated for connections that originated on the computing device (e.g.,outgoing connections).

The connection-event notices are communicated to the Internet-baseddevice management service 201. The convention-event notice can includedetailed connection information and detailed identification informationfor the computing device from which the connection-event noticeoriginated. The connection information can include the source IPaddress, target IP address, device port on which the connectionoperates, software instance or process on machine that is being exposedto the Internet (e.g., opened the connection), the entire command linethat is listening to the connection, and the like. The identificationinformation can include the computing device's Globally UniqueIdentifier (“GUID”) or Universally Unique Identifier (“UUID”) dependingon the operating environment. Other identification information that maybe used includes a media access control (“MAC”) address and fullyqualified domain name While these are known ways to identify a device,existing technology for identifying Internet-facing devices do not haveaccess to this information because the technologies do not have directaccess to the organization's device. The monitoring agent 230 is runningon the computing device and can provide detailed information about thedevice and the connection that is not available to other method used toidentify Internet-facing devices.

The Internet-facing device management service 201 comprises anagent-status processing component 212, a connection-event processingcomponent 214, and a security-patch deployment component 216. TheInternet-facing device management service 201 comprises organizationaldevice data store 220, organizational IP address data store 222,organizational Internet-facing device data store 224, and organizationalInternet-facing software data store 226.

The agent-status processing component 212 receives agent-status reportsand processes them. The agent-status report can include detailedidentification information for the computing device from which thenotice originated. This identification information includes IPaddresses, possibly including subnets, assigned to the computing device.The IP addresses received from computing devices within the organizationare used to build a data store of IP addresses associated with theorganization.

The agent-status processing component 212 can extract an IP address fromthe notice and determine whether the IP address is already listed in theorganization IP address store 222. If it is already listed, then in oneaspect no further action may be taken. In another aspect, the computingdevice associated with the IP address in the organization IP addressstore 222 is confirmed to be the computing device associated with thenotice. If a different computing device is associated with the IPaddress in the data store, then the record is updated to associate theIP address with the computing device from which the agent-status reportwas received. The updated record may list both computing devicesassociated with the IP address or replace the previously listedcomputing device with the computing device from which an agent-statusreport containing the IP address was most recently received.

The agent-status processing component 212 can add an IP address to theorganizational IP address store 222 when an IP address in theagent-status update is not found in the organizational IP address store222. As mentioned, the computing device from which the notice wasreceived may be associated with the IP address in the organizational IPaddress store 222. The agent-status processing component 212 may alsoadd identification information for computing devices to the device datastore 220 when a device associated with the notice is not already indevice data store 220. Similarly, if the identification information inan agent-status report differs from the information in the device datastore 220 then the data store 220 may be updated.

The connection-event processing component 214 processes connection-eventnotices to determine whether the computing device associated with theconnection-event notice is Internet facing. The connection-eventprocessing component 214 first determines whether the source IP addressindicated in a notice is associated with the organization. Thisdetermination can be made by comparing the source IP address to the listof organizational IP address is in the organizational IP address store222. If the source IP address from the notice is not an organizationalIP address, then the connection originated outside of the organizationfrom the Internet. The computing device associated with thenon-organizational source IP address is thus determined to be anInternet-facing device. Identification information for the computingdevice is then added to the Internet-facing device data store 224, ifthe computing device is not already listed in the data store 224.

The connection-event processing component 214 processes connection-eventnotices to determine whether the instances of software on the computingdevice associated with the connection-event notice is Internet facing.Not all software on an Internet-facing device is Internet facing. Thesoftware using the connection may be Internet-facing software instances.Software instances that are determined to be Internet-facing are addedto a list of Internet-facing software instances. The Internet-facingsoftware instance can be identified in the connection-event notice asusing the connection. As mentioned, the connection-event notice can listany software instances that opened the connection or are otherwisecommunicating over the connection. Identification information forInternet-facing software instances can be added to the organizationalInternet-facing software data store 226.

The security-patch deployment component 216 is an example of a componentthat can make use of the list of Internet-facing devices inorganization. For example, when a patch is received for a softwarehaving Internet-facing software instances, the patch may be rolled outto these instances first. Similar prioritization could be given toInternet-facing devices when performing maintenance, updates, securitychecks, or other management tasks.

The organizational device data store 220 stores a record of devicesassociated with the organization. Each device record can includedetailed identification information including the computing device'sGlobally Unique Identifier (“GUID”) or Universally Unique Identifier(“UUID”) depending on the operating environment. Other identificationinformation that may be used includes a media access control (“MAC”)address and fully qualified domain name. The organizational device datastore 220 may be populated with information received in agent-statusreports and/or connection-event notices.

The organizational IP address store 222 stores IP addresses associatedwith the organization. As described previously, these addresses may beextracted from agent-status reports. In aspects, IP addresses may alsobe added to the IP address store 222 through other methods.

The organizational Internet-facing device data store 224 includes a listof Internet-facing devices associated with the organization. Asdescribed previously, the listed devices are updated in response toprocessing connection-event notices.

The organizational Internet-facing software data store 226 includes alist of Internet-facing software instances associated with theorganization. The software instance may be identified usingidentification information for the computing device on which thesoftware instance runs. As described previously, the listed softwareinstances are updated in response to processing connection-eventnotices.

EXEMPLARY METHODS

Now referring to FIGS. 3-5 , each block of methods 300, 400, and 500,described herein, comprises a computing process that may be performedusing any combination of hardware, firmware, and/or software. Forinstance, various functions may be carried out by a processor executinginstructions stored in memory. The methods may also be embodied ascomputer-usable instructions stored on computer storage media. Themethod may be provided by a standalone application, a service or hostedservice (standalone or in combination with another hosted service), or aplug-in to another product, to name a few. In addition, methods 300,400, and 500 are described, by way of example, with respect to theenvironment 200 of FIG. 2 . However, these methods may additionally oralternatively be executed by any one system, or any combination ofsystems, including, but not limited to, those described herein.

Turning now to FIG. 3 , a flow chart showing a method 300 of identifyingInternet facing computing devices in an organization is provided, inaccordance with an aspect of the technology described herein.

The method 300, at block 302 includes receiving, over a network, an IPaddress for a computing device from a monitoring agent running on thecomputing device. The computing device may be associated with anorganization that is attempting to identify all of its Internet facingdevices. In one aspect, a monitoring agent is installed on a largepercentage of an organization's devices. Each monitoring agent mayprovide information for the computing device on which it is running TheIP address may be provided in an agent-status report. The agent-statusreport comprises an IP address associated with the computing device onwhich the monitoring agent is running and may include other identifyinginformation for the computing device, such as a GUID.

The method 300, at block 304 includes adding the IP address to a storeof organizational IP addresses. The IP address can be retrieved from theagent-status report. A determination is then made whether the IP addressis already listed in the organization IP address store. If it is alreadylisted, then in one aspect no further action may be taken. In anotheraspect, the computing device associated with the IP address in theorganization IP address store is confirmed to match the computing deviceassociated with the notice. The store can be updated if a mismatch isdetected.

The method 300, at block 306 includes receiving, over the network, aconnection-event notice from the monitoring agent describing aconnection between the computing device and a second computing device.The connection-event notice comprises identification information for thecomputing device and connection information comprising a source IPaddress associated with the second computing device. The identificationinformation can include the computing device's Globally UniqueIdentifier (“GUID”) or Universally Unique Identifier (“UUID”) dependingon the operating environment. Other identification information that maybe used includes a media access control (“MAC”) address and fullyqualified domain name The connection information can include the sourceIP address, target IP address, device port on which the connectionoperates, process on machine that is being exposed to the Internet(e.g., opened the connection), the entire command line that is listeningto the connection, and the like.

The method 300, at block 308 includes determining the computing deviceis Internet facing by determining the source IP address is not in thestore of organizational IP addresses. This determination can be made bycomparing the source IP address to the list of organizational IP addressis in the organizational IP address store. If the source IP address fromthe notice is not an organizational IP address, then the connectionoriginated outside of the organization from the Internet. The computingdevice associated with the notice reciting the non-organizational sourceIP address is thus determined to be an Internet-facing device.Identification for the computing device is then added to theInternet-facing device data store, if the computing device is notalready listed in the Internet-facing device data store.

The method 300, at block 310 includes adding an indication the computingdevice described in the identification information to a store ofInternet-facing computing devices. The indication can include the IPaddress, GUID, and/or other identifying information for the computingdevice.

Turning now to FIG. 4 , a flow chart showing a method 400 of identifyingInternet facing computing devices in an organization is provided, inaccordance with an aspect of the technology described herein.

The method 400, at block 402 includes communicating, over a network by amonitoring agent running on a computing device, an IP address associatedwith the computing device to an Internet-facing device managementservice.

The method 400, at block 404 includes detecting, by the monitoringagent, a connection on the computing device with a second computingdevice. The connection designates a source IP address that is notassociated with the computing device.

The method 400, at block 406 includes generating, by the monitoringagent, a connection-event notice comprising identification informationfor the computing device and connection information comprising thesource IP address. The identification information can include thecomputing device's Globally Unique Identifier (“GUID”) or UniversallyUnique identifier (“UUID”) depending on the operating environment. Otheridentification information that may be used includes a media accesscontrol (“MAC”) address and fully qualified domain name The connectioninformation can include the source IP address, target IP address, deviceport on which the connection operates, process on machine that is beingexposed to the Internet (e.g., opened the connection), the entirecommand line that is listening to the connection, and the like.

In one aspect, the connection-event notice is generated upon detecting aconnection that satisfies event generation criteria. In one aspect, theconnection is a Transmission Control Protocol and the Internet Protocol(“TCP/IP”) or a User Datagram Protocol (“UDP”) connection, but otherconnection types may also be monitored. The event generation criteriacan include determining that the source IP address associated with aconnection is a public IP address. Connections originating on theInternet should have a public source IP address. Thus, aspects of thetechnology described herein may generate events only when the source IPaddress is a public IP address. A connection with a private source IPaddress may not provide useful information because it is likelyoriginating within an organization's network, rather than the Internet.

The second event generation criteria identifies incoming connections.Incoming connections originate at a different computing device and havea source IP address associated with the different computing device.Thus, the second event generation criteria may be determining that thesource IP address is not associated with the computing device on whichthe monitoring agent is running In an aspect, connection-event noticesare not generated for connections that originated on the computingdevice (e.g., outgoing connections).

The method 400, at block 408 includes communicating the connection-eventnotice over the network to the Internet-facing device managementservice.

Turning now to FIG. 5 , a flow chart showing a method 500 of identifyingInternet facing computing devices in an organization is provided, inaccordance with an aspect of the technology described herein.

The method 500, at block 502 includes detecting, by a monitoring agentrunning on a computing device, a connection on the computing device witha second computing device, the connection designating a source IPaddress.

The method 500, at block 504 includes determining, by the monitoringagent, that the source IP address is not associated with the computingdevice. Incoming connections originate at a different computing deviceand have a source IP address associated with the different computingdevice, rather than the computing device being monitored.

The method 500, at block 506 includes classifying, by the monitoringagent, the source IP address as a public IP address. A source IP addresscan be classified as public by comparing it against a ranges definingprivate IP addresses. As mentioned, a goal of the technology is toidentify Internet-facing devices. A connection with a private source IPaddress may not provide useful information because it is likelyoriginating within an organization's network, rather than the Internet.Connections originating on the Internet should have a public source IPaddress. Thus, aspects of the technology described herein may generateevents only when the source IP address is a public IP address.

The method 500, at block 508 includes in response to the classifying,generating, by the monitoring agent, a connection-event noticecomprising identification information for the computing device andconnection information that includes the source IP address. Theidentification information can include the computing device's GloballyUnique Identifier (“GUID”) or Universally Unique Identifier (“UUID”)depending on the operating environment. Other identification informationthat may be used includes a media access control (“MAC”) address andfully qualified domain name The connection information can include thesource IP address, target IP address, device port on which theconnection operates, process on machine that is being exposed to theInternet (e.g., opened the connection), the entire command line that islistening to the connection, and the like.

In one aspect, the connection-event notice is generated upon detecting aconnection that satisfies event generation criteria. In one aspect, theconnection is a Transmission Control Protocol and the Internet Protocol(“TCP/IP”) or a User Datagram Protocol (“UDP”) connection, but otherconnection types may also be monitored. The event generation criteriacan include determining that the source IP address associated with aconnection is a public IP address. Connections originating on theInternet should have a public source IP address. Thus, aspects of thetechnology described herein may generate events only when the source IPaddress is a public IP address.

The second event generation criteria identifies incoming connections.Incoming connections originate at a different computing device and havea source IP address associated with the different computing device.Thus, the second event generation criteria may be determining that thesource IP address is not associated with the computing device on whichthe monitoring agent is running In an aspect, connection-event noticesare not generated for connections that originated on the computingdevice (e.g., outgoing connections).

The method 500, at block 510 includes communicating the connection-eventnotice over a network to an Internet facing device management service.

With reference to FIG. 6 , computing device 600 includes a bus 610 thatdirectly or indirectly couples the following devices: memory 612, one ormore processors 614, one or more presentation components 616, one ormore input/output (I/O) ports 618, one or more I/O components 620, andan illustrative power supply 622. Bus 610 represents what may be one ormore busses (such as an address bus, data bus, or combination thereof).Although the various blocks of FIG. 6 are shown with lines for the sakeof clarity, in reality, these blocks represent logical, not necessarilyactual, components. For example, one may consider a presentationcomponent such as a display device to be an I/O component. Also,processors have memory. The inventors hereof recognize that such is thenature of the art and reiterate that the diagram of FIG. 6 is merelyillustrative of an exemplary computing device that can be used inconnection with one or more aspects of the present technology.Distinction is not made between such categories as “workstation,”“server,” “laptop,” “handheld device,” etc., as all are contemplatedwithin the scope of FIG. 6 and with reference to “computing device.”

Computing device 600 typically includes a variety of computer-readablemedia. Computer-readable media can be any available media that can beaccessed by computing device 600 and includes both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable media may comprisecomputer-storage media and communication media.

Computer-storage media includes both volatile and nonvolatile, removableand non-removable media implemented in any method or technology forstorage of information such as computer-readable instructions, datastructures, program modules, or other data. Computer storage mediaincludes, but is not limited to, RAM, ROM, EEPROM, flash memory or othermemory technology, CD-ROM, digital versatile disks (DVDs) or otheroptical disk storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed bycomputing device 600. Computer storage media does not comprise signalsper se.

Communication media typically embodies computer-readable instructions,data structures, program modules, or other data in a modulated datasignal such as a carrier wave or other transport mechanism and includesany information delivery media. The term “modulated data signal” means asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media includes wired media, such as awired network or direct-wired connection, and wireless media, such asacoustic, RF, infrared, and other wireless media. Combinations of any ofthe above should also be included within the scope of computer-readablemedia.

Memory 612 includes computer storage media in the form of volatileand/or nonvolatile memory. The memory may be removable, non-removable,or a combination thereof. Exemplary hardware devices include solid-statememory, hard drives, optical-disc drives, etc. Computing device 600includes one or more processors 614 that read data from various entitiessuch as memory 612 or I/O components 620. Presentation component(s) 616presents data indications to a user or other device. Exemplarypresentation components include a display device, speaker, printingcomponent, vibrating component, and the like.

The I/O ports 618 allow computing device 600 to be logically coupled toother devices, including I/O components 620, some of which may be builtin. Illustrative components include a microphone, joystick, game pad,satellite dish, scanner, printer, wireless device, etc.

The I/O components 620 may provide a natural user interface (NUI) thatprocesses air gestures, voice, or other physiological inputs generatedby a user. In some instances, inputs may be transmitted to anappropriate network element for further processing. An NUI may implementany combination of speech recognition, touch and stylus recognition,facial recognition, biometric recognition, gesture recognition both onscreen and adjacent to the screen, air gestures, head and eye tracking,and touch recognition associated with displays on the computing device600. The computing device 600 may be equipped with depth cameras, suchas stereoscopic camera systems, infrared camera systems, RGB camerasystems, and combinations of these, for gesture detection andrecognition. Additionally, the computing device 600 may be equipped withaccelerometers or gyroscopes that enable detection of motion. The outputof the accelerometers or gyroscopes may be provided to the display ofthe computing device 600 to render immersive augmented reality orvirtual reality.

Some aspects of computing device 600 may include one or more radio(s)624 (or similar wireless communication components). The radio 624transmits and receives radio or wireless communications. The computingdevice 600 may be a wireless terminal adapted to receive communicationsand media over various wireless networks. Computing device 600 maycommunicate via wireless protocols, such as code division multipleaccess (“CDMA”), global system for mobiles (“GSM”), or time divisionmultiple access (“TDMA”), as well as others, to communicate with otherdevices. The radio communications may be a short-range connection, along-range connection, or a combination of both a short-range and along-range wireless telecommunications connection. When we refer to“short” and “long” types of connections, we do not mean to refer to thespatial relation between two devices. Instead, we are generallyreferring to short range and long range as different categories, ortypes, of connections (i.e., a primary connection and a secondaryconnection). A short-range connection may include, by way of example andnot limitation, a Wi-Fi® connection to a device (e.g., mobile hotspot)that provides access to a wireless communications network, such as aWLAN connection using the 802.11 protocol; a Bluetooth connection toanother computing device is a second example of a short-rangeconnection, or a near-field communication connection. A long-rangeconnection may include a connection using, by way of example and notlimitation, one or more of CDMA, GPRS, GSM, TDMA, and 802.16 protocols.

Many different arrangements of the various components depicted, as wellas components not shown, are possible without departing from the scopeof the claims below. Aspects of the present technology have beendescribed with the intent to be illustrative rather than restrictive.Alternative aspects will become apparent to readers of this disclosureafter and because of reading it. Alternative means of implementing theaforementioned can be completed without departing from the scope of theclaims below. Certain features and sub-combinations are of utility andmay be employed without reference to other features and sub-combinationsand are contemplated within the scope of the claims.

What is claimed is:
 1. One or more computer storage media havingcomputer-executable instructions embodied thereon that, when executed,by one or more processors, causes the one or more processors to performa method of identifying Internet facing computing devices in anorganization, the method comprising: receiving, over a network, an IPaddress for a computing device from a monitoring agent running on thecomputing device; adding the IP address to a store of organization IPaddresses; receiving, over the network, a connection-event notice fromthe monitoring agent describing a connection between the computingdevice and a second computing device, the connection-event noticecomprising identification information for the computing device andconnection information comprising a source IP address associated withthe second computing device; determining the computing device isInternet facing by determining the source IP address is not in the storeof organization IP addresses; and adding an indication for the computingdevice described in the identification information to a store ofInternet-facing computing devices.
 2. The media of claim 1, wherein theconnection information comprises identification of a softwareapplication that participated in the connection.
 3. The media of claim2, wherein the method further comprises adding an instance of thesoftware application running on the computing device to a store ofInternet-facing instances of the software application.
 4. The media ofclaim 3, wherein the method further comprises: receiving a securitypatch for the software application; identifying instances of thesoftware application within the organization that are Internet facing byanalyzing the store of Internet-facing instances of the softwareapplication; and installing the security patch on instances of thesoftware application within the organization that are Internet facingbefore installing the security patch on instances of the softwareapplication that are not Internet facing.
 5. The media of claim 1,wherein the identification information comprises a Globally UniqueIdentifier (“GUID”) or Universally Unique Identifier (“UUID”).
 6. Themedia of claim 1, wherein the connection information comprises a port onthe computing device through which the connection was made.
 7. The mediaof claim 1, wherein the one or more IP addresses associated with thecomputing device on which the monitoring agent is running comprises asubnet address.
 8. The media of claim 1, wherein the identificationinformation comprises a MAC address for the computing device.
 9. Themedia of claim 1, wherein the connection information comprisesidentification of a command line that is listening on the connection.10. The media of claim 1, wherein the connection information alsocomprises a subnet address.
 11. A method of identifying Internet facingcomputing devices in an organization, the method comprising: receiving,over a network, an IP address for a computing device from a monitoringagent running on the computing device; adding the IP address to a storeof organization IP addresses; receiving, over the network, aconnection-event notice from the monitoring agent describing aconnection between the computing device and a second computing device,the connection-event notice comprising connection information comprisinga source IP address associated with the second computing device;determining the computing device is Internet facing by determining thesource IP address is not in the store of organization IP addresses; andadding an indication for the computing device described in theidentification information to a store of Internet-facing computingdevices.
 12. The method of claim 1, wherein the connection informationcomprises identification of a software application that participated inthe connection.
 13. The method of claim 2, wherein the method furthercomprises adding an instance of the software application running on thecomputing device to a store of Internet-facing instances of the softwareapplication.
 14. The method of claim 3, wherein the method furthercomprises: receiving a security patch for the software application;identifying instances of the software application within theorganization that are Internet facing by analyzing the store ofInternet-facing instances of the software application; and installingthe security patch on instances of the software application within theorganization that are Internet facing before installing the securitypatch on instances of the software application that are not Internetfacing.
 15. The method of claim 1, wherein the identificationinformation comprises a Globally Unique Identifier (“GUID”) orUniversally Unique Identifier (“UUID”).
 16. One or more computer storagemedia having computer-executable instructions embodied thereon that,when executed, by one or more processors, causes the one or moreprocessors to perform a method of identifying Internet facing computingdevices in an organization, the method comprising: receiving, over thenetwork, a connection-event notice from the monitoring agent describinga connection between the computing device and a second computing device,the connection-event notice comprising connection information comprisinga source IP address associated with the second computing device;determining the computing device is Internet facing by determining thesource IP address is not in a store of organization IP addresses; andadding an indication for the computing device described in theidentification information to a store of Internet-facing computingdevices.
 17. The media of claim 16, wherein the connection informationcomprises identification of a software application that participated inthe connection.
 18. The media of claim 17, wherein the method furthercomprises adding an instance of the software application running on thecomputing device to a store of Internet-facing instances of the softwareapplication.
 19. The media of claim 18, wherein the method furthercomprises: receiving a security patch for the software application;identifying instances of the software application within theorganization that are Internet facing by analyzing the store ofInternet-facing instances of the software application; and installingthe security patch on instances of the software application within theorganization that are Internet facing before installing the securitypatch on instances of the software application that are not Internetfacing.
 20. The media of claim 16, wherein the connection informationcomprises identification of a command line that is listening on theconnection.